Here is HHS response for you: 



In October 2011, the President issued Executive Order 13587 to improve the 
security of classified computer networks and classified material. As part of the 
EO, the President directed federal departments and agencies with classified 
networks to establish insider threat detection and prevention programs. 



The President also established the National Insider Threat Task Force under joint 
leadership of the Attorney General and the Director of National Intelligence to 
assist agencies in developing and implementing their insider threat programs. In 
developing standards for these programs, the Task Force specifically sought to 
develop standards that do not erode civil liberties, civil rights, or privacy 
protections for government employees. 



In November 2012, following an extensive interagency coordination and vetting 
process, the President issued the National Insider Threat Policy and the 
Minimum Standards for Executive Branch Insider Threat Programs via a 
Presidential Memorandum. 



To date, the policy and standards have been treated as internal executive branch 
guidance and have not been made broadly available. Further dissemination of 
the policy and standards are under review. Accordingly, details regarding 
various agency insider threat programs have not been made public. For more 
details, I direct you to the ODNI. 



Question from McClatchy 



Hello, I am reporting on how federal agencies are implementing President 
Obama's Oct. 7, 2011, Executive Order 13587 on improving safeguards against 
unauthorized disclosures of classified information. 

Here's the order: http://www.whitehouse.gov/the-press- 

office/201 1/10/07/executive-order-structural-reforms-improve-security-classified- 
networks- 

An October 14, 201 1 memo instructed your agency and others to carry out the 
executive order. I have the following questions: 

1 . What specific steps has your department taken to implement the EO? 



2. Did your self-assessments determine that your department's safeguards 
against UDs were inadequate? If so, what corrective actions were taken and 
improvements realized? 

3. Has your agency begun providing monthly reports on UDs to the Senior 
Information Sharing and Safeguarding Steering Committee? 

4. Has your agency selected a POC to facilitate this reporting? 

5. Have your efforts resulted in increased detection of UDs? If so, how does 
your agency determine whether they should be handled administratively or 
referred for criminal investigation? 

6. Has your agency encountered any specific problems or objections to 
implementing the EO? If so, what have they been? 

7. Can we get copies of the guidance and standards that your agency has 
developed for insider threat detection? 

8. Can you provide us with your self-assessments or summaries of the 
assessments? 

9. How will you be handling the reporting process by co-workers logistically? Is 
there going to be a 800 number? Or, internet reporting? 

10. Has your agency identified any other "insider threats" as part of your new 
definition other than leaking classified. Other agencies have identified other 
insider threats that are unique to their agencies. 

1 1 . The Minimum standards call for employee training of the insider threat, 
specifically with the recognition of insider threat behavior indicators. Can we have 
copies of the training materials? How about the list of behavior indicators? Does 

it include on-line behaviors? 

12. The Insider Threat point person in each agency is going to have access to a 
wide range of departments that don't include only security, such as human 
resources. How do you ensure that someone who goes to human resources for a 
personal issue is not then turned in to the Insider threat official. For example, 
someone says they have a personal issue that is part of the behavior for an 
insider threat. My understanding is that human resources would then have to 
pass along that information to the Insider Threat official. If so, how does your 
agency handle that kind of case? 

13. Did you agency have to create this program from scratch? If not, what pre- 
existing office/program are you working with? 



